Jul 26, 2006

Windows Installer Clean Up utility

Ever got an error message when you tried uninstalling a program that used the Microsoft Installer (MSI) sounding like "the installation source for this product is not available"? Well I did. I tried uninstalling Quark and I couldn't because I have deleted the installation source files.
First error message I got:
"The feature you are trying to use is on a network resource that is unavailable.
Clik OK to try again, or enter an alternate path to a folder containing the installation package 'QuarkXPress 6.0.msi' in the box below"

source not found

I didn't remember where I've put the CD with the original installation package so clicking Cancel I realized that it's not going to be that easy to remove the program, as the second error message popped-in: "The installation source for this product is not available. Verify that the source exists and that you can access it."
installation source not available

Ok. I've decided to delete the installation folder completely, but I didn't want to leave the registry entries not cleaned. So after a little research I've found a utility called WINDOWS INSTALLER CLEANUP that helps safely remove Windows Installer-related registry settings from your computer for certain programs that don't want to uninstall. You can download it (and read more about how it works) from here: Description of the Windows Installer CleanUp Utility.
Once downloaded simply install it following the wizard
windows installer cleanup

Now to cleanup Quark installation (in this case, but this happens with Office too) go to click Start, point to Programs, and then click Windows Install CleanUp. You'll see the interface of this utility and from that list select the application that you want to cleanup (Quark in this case) and after that click on Remove.
remove quark

On the next window you'll get a warning, just click Ok to complete this process: "Warning - All items selected will be removed from the Windows Installer database. In order for the items to work properly, you must individually re-install all items selected. Select OK to continue removing product, Cancel to abort."
completing removal

Last thing to do is to click Exit to close the utility. Now the registry keys for Quark and the entry in the Add/Remove Programs aren't there anymore and you can remove the rest of the Quark files. As I mentioned above this might happen with Office too, as stated in this support kbase note: "Error 1612. The installation source for this product is not available" error message when you install or remove Office XP Service Pack 1

Jul 17, 2006

0 seconds delay when deleting files in Explorer/Total Commander

When you try to delete a file or directory in Windows Explorer (or Total Commander) that is in use by another program, it takes a long time before an error message tells you that the file cannot be removed. With a little bit of research I've found that this happens because there is a 5 seconds delay in deleting the files, so a solution would be to make that delay 0 seconds by patching the shell32.dll. The process is a little complicated so if you do not really understand something is better not to try it. This was tested on Windows XP and I recommend doing a backup before trying it. Here are the steps:

  1. First of all you need to make sure that there is only one shell32.dll file. Thus, go to C:\\Windows\system32\dllcache (assuming C is your system partition) and rename shell32.dll (if it exists) to shell32.dll.bak
    shell32.dll rename

  2. Now you will need a hex editor to patch the shell32.dll file. I used Tiny Hexer (which is free) so you can download and install it.

  3. Next you need to copy shell32.dll from C:\\Windows\system32\ to a location where you will edit it.
    shell32.dll original
    I've created a folder called temp on C that you can delete after the file is edited and you've overwritten the original one. Once the file shell32.dll is on the temp folder, right click it and send it to the Tiny Hexer program, as you can see in the image below:
    open with tiny hexer

  4. Now you will need to do some changes in the hex string 8bff558bec565733ffeb2183ff05 (that appears twice in the file). In Tiny Hexer go to Edit->Find, paste the hex string I've mentioned above and click on Find.
    find in tiny hexer

  5. On both occurrences of the hex string the ending digits are 05. Those need to become 00. Note that you don't have to hit delete and after that write the 0, but instead you have to put your cursor before 5 and press on 0, the last digit will be automatically replaced. Do this on the first occurrence:

    and on the second occurrence


  6. Now that these changes are done click on Save. You'll see that automatically a .bak file is created too, but you will need the shell32.dll file. If you try to copy this modified file to C:\\Windows\system32\ you'll get an error, this is why you have to rename first the shell32.dll file from C:\\Windows\system32\ to shell32.dll_. When you'll do this an error will appear (regarding the windows protection) and you have to click Yes to be able to continue.
    windows system protection

  7. Now you can copy the shell32.dll file that you edited from the temp folder to C:\\Windows\system32\.
    copy shell32.dll file

  8. Last thing to do is restarting the computer. If everything works fine you'll see that there is no delay now when trying to delete locked files


You can also read more on these websites:
Eliminating the delay when deleting in-use files/dirs
Eliminating Explorer's delay when deleting an in-use file

[update]Well this hack was posted on Digg and I've seen a lot of comments and other tips. Here are some more details:

  • first of all what this hack does is not deleting files in use, but removing the 5 seconds delay in receiving the answer from Windows when deleting a file in use. You know, this must have happened to you too, you hit delete on a file and no answer, you hit delete again and it just blocks. Removing this 5 seconds delay will give you the "Cannot delete message" faster, avoiding the block. This also works on Total Commander.

  • if you need a solution to delete locked/in use files, you can use Unocker, a nice program that acts as an Windows Explorer add-in (yeah, it doesn't work in Total Commander)

  • last but not the least, for those that are worried on what they can mess by patching the shell32.dll file, you must know that there are ways to revert to the previous state of that file. In step 6 above you see that the Tiny Hexer program created a shell32.dll.bak file, so if something goes wrong you can remove the .bak extension and copy that file back to the original location. Or, if that's too complicated, you can use the System File Checker tool from Windows that will "scan all protected system files immediately and replaces incorrect versions with correct Microsoft versions". Basically you hit Start->Run, type sfc /scannow and press Enter. You'll get prompted to enter your Windows CD in to restore the system file that was changed. Don't trust me on this, read the more detailed procedure from Microsoft.

Jul 13, 2006

Google indexing .exe files - part 2

Well in my original blog post (Google indexing executable files) I omitted to put a proof on how I got to see exe files indexed in Google. Thing is that I'm subscribed to Google Alerts (a service from Google that allows you to receive email notifications when relevant Google results from web + news are found based on a query or topic) for the term Backup4all. So everytime Google finds it in the web results or news, it send an email. This is how I received the following email alert, saying that the mentioned website contained the search term Backup4all:





As you can see it is an executable file hosted on a crack site. Later I downloaded that file and installed it on a "doomed" computer (as it turned out the file contained some Chinese trojans). Now, as others have mentioned this shouldn't be a risk for people that know what they're doing, but let's not forget that there are others not so computer literate that would trust anything coming from Google (of course there is the possibility that they already have a form of spyware installed, judging from statistics that say 80% of computers have some form of spyware).

Of course for every bad part there is a good one too. Websense developed an application that uses the Google API to find viruses and other infected exe files indexed. Now it remains the problem of shutting those websites down.

An interesting thing is that now the search for "Signature: 00004550" yields about half the number of results it did 3 weeks ago. Plus that result with the crack site I found it's nowhere to be found now, so they must have worked on removing some of these files.

Jul 3, 2006

Preview a TinyURL

TinyURL.com is a website that allows you to convert a long url to a tiny one that will not break in email postings and never expire.
However, I don't trust clicking on these types of links, as you don't know everytime what's "hidden" (affiliate/tracking links for instance). But I've seen that they've introduced a new feature that allows you to preview the link before visiting it. This is a great improvement and you can turn this feature on by visiting http://tinyurl.com/preview.php and clicking on Click here to enable previews (make sure you allow cookies).

After that, each time you'll click on a tinyurl link you'll be directed first to a preview page, like the one you see below:

Preview a TinyURL